Reader small image

You're reading from  Implementing Splunk: Big Data Reporting and Development for Operational Intelligence

Product typeBook
Published inJan 2013
PublisherPackt
ISBN-139781849693288
Edition1st Edition
Tools
Concepts
Right arrow
Author (1)
VINCENT BUMGARNER
VINCENT BUMGARNER
author image
VINCENT BUMGARNER

Vincent Bumgarner has been designing software for over 20 years, working with many languages on nearly as many platforms. He started using Splunk in 2007 and has enjoyed watching the product evolve over the years. While working for Splunk, he has helped many companies train dozens of users to drive, extend, and administer this extremely flexible product. At least one person in every company he has worked with has asked for a book, and he hopes that this book will help fill their shelves.
Read more about VINCENT BUMGARNER

Right arrow

Creating workflow actions


Workflow actions allow us to create custom actions based on the values in search results. The two supported actions either run a search or link to a URL.

Running a new search using values from an event

To build a workflow action, navigate to Manager | Fields | Workflow actions and click on New. You are presented with this form:

Let's walk through the following fields:

  • Destination app: This is the app where the workflow action definition will live.

  • Name: This is the name used in configuration files. This name cannot contain spaces, but underscores are fine.

  • Label: This is what will appear in the menu. It can contain variables. In this case, we have included $user$, which will be populated with the value of the user field from the event.

  • Apply only to the following fields: This workflow action will only appear on an event if all fields specified in this list have a value. Show action in will determine which menus can contain the workflow action.

  • Apply only to the following...

lock icon
The rest of the page is locked
Previous PageNext Page
You have been reading a chapter from
Implementing Splunk: Big Data Reporting and Development for Operational Intelligence
Published in: Jan 2013Publisher: PacktISBN-13: 9781849693288

Author (1)

author image
VINCENT BUMGARNER

Vincent Bumgarner has been designing software for over 20 years, working with many languages on nearly as many platforms. He started using Splunk in 2007 and has enjoyed watching the product evolve over the years. While working for Splunk, he has helped many companies train dozens of users to drive, extend, and administer this extremely flexible product. At least one person in every company he has worked with has asked for a book, and he hopes that this book will help fill their shelves.
Read more about VINCENT BUMGARNER